Critical Spin Lock Initialization Issue in Linux Kernel Package
Summary
DEBIAN-CVE-2025-37993: In the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_class_allocate_dev(): initialize spin lock on device probe The spin lock tx_handling_spinlock in struct m_can_classdev is not being in... Affects linux versions < 6.12.29-1. Fixed in 6.12.29-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various environments, from servers to embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes or unauthorized access. This specific vulnerability affects the 'linux' package in Debian versions 13 and 14, highlighting a critical issue in the CAN (Controller Area Network) subsystem.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the CAN subsystem, specifically within the m_can_class_allocate_dev() function. The spin lock 'tx_handling_spinlock' in the struct 'm_can_classdev' is not initialized properly. This oversight can lead to a 'spinlock bad magic' error when attempting to send CAN frames using tools like 'cansend' from the can-utils package. The error manifests as a kernel panic, potentially causing system instability and affecting the reliability of CAN communications.
How To Fix
Minimum fixed version
6.12.29-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described in the 'how_to_fix' section.
Conclusion
The identified vulnerability in the Linux kernel's CAN subsystem poses significant risks to system stability and reliability. It is crucial for users to update their 'linux' package to the patched version 6.12.29-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to the improper initialization of a spin lock in the Linux kernel's CAN subsystem, which can lead to system instability.
The vulnerability affects Debian versions 13 and 14 of the 'linux' package prior to version 6.12.29-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability can cause kernel panics, leading to system crashes and potential data loss, especially in systems relying on CAN communications.
The most effective mitigation is to update the package to the patched version. There are no known workarounds to address the issue without applying the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
